Description
Internet Key Exchange (IKE)
Complete Definition
IKE is the protocol used to set up a security association (SA) in the IPsec protocol suite.
IKE establishes a shared security policy and authenticates keys for services (such as IPSec) that require keys. Before any IPSec traffic can be passed, each router/firewall/host must verify the identity of its peer. This can be done by manually entering pre-shared keys into both hosts or by a CA service.
IKE uses a Diffie-Hellman (DH) key exchange to set up a shared session secret, from which cryptographic keys are derived. Public key techniques or, alternatively, a pre-shared key, are used to mutually authenticate the communicating parties.
IKE builds upon the OAKLEY protocol.
The IKE protocol uses UDP packets, usually on port 500, and generally requires 4-6 packets with 2-3 turn-around times to create an SA on both sides. The negotiated key material is then given to the IPsec stack. For instance, this could be an AES key, information identifying the IP endpoints and ports that are to be protected, as well as what type of IPsec tunnel has been created. The IPsec stack, in turn, intercepts the relevant IP packets if and where appropriate and performs encryption/decryption as required. Implementations vary on how the interception of the packets is done—for example, some use virtual devices, others take a slice out of the firewall, etc.
IKE Wikipedia Definition
RFC:
- Internet Key Exchange Protocol - RFC 2409
- Internet Key Exchange (IKEv2) Protocol - RFC 4306
Also See:
